Glad you found it useful, and agreed!
We just published "The Definitive Guide to Bitcoin Inheritance."
We break down everything you need to know about securing your legacy: from Custodial and DIY solutions to the new standard of Autonomous Inheritance, leveraging on-chain timelocks.
Read the full guide: https://nunchuk.io/blog/bitcoin-inheritance-guide
You might be interested in our inheritance solution, using on-chain timelocks: https://nunchuk.io/blog/autonomous-inheritance
"When the Canadian dollar becomes worthless, we will be here to serve you, too."
That was our closing reply to the Ontario Superior Court of Justice in 2022, when they ordered us to freeze and disclose information about the bitcoin involved in the Freedom Convoy protest.
The story of how that email came about has never been told. Today, we’re sharing that story, and how that event forged our DNA & mission.
***
February 2022. The Freedom Convoy protest was paralyzing Ottawa. Two years of lockdowns and mandates had created incredible social tension.
On Feb 14, Justin Trudeau invoked the Emergencies Act for the first time in Canadian history. It was designed for wars or terrorism; it was now being used against protesters.
Protesters’ bank accounts were frozen without due process. GoFundMe seized $10M in donations at the government’s request. The RCMP demanded that financial firms blacklist Bitcoin addresses.
The Ontario Securities Commission flagged tweets by Coinbase CEO Brian Armstrong and Kraken CEO Jesse Powell criticizing the use of the Emergencies Act to law enforcement. Balaji Srinivasan questioned whether Canada was still a “democracy”. Police began mobilizing in Canada’s capital.
The authorities seemed willing to use everything, even extraordinary measures, to quash the protest.
Many Bitcoin companies backed away, despite having millions in funding.
Jesse Powell, having previously donated one bitcoin to the protest, warned users that Kraken “cannot protect you” from the Canadian government. Elon Musk, who voiced support for the protesters, tweeted “I wish I could help. At this point, it seems that voting at the next election is the remedy.” Even powerful CEOs seemed powerless in the situation.
Then, we received the Mareva injunction.
Nunchuk, a tiny startup still in its infancy, was ordered to freeze assets and disclose information. We are self-custodial and technically unable to comply. But the threat was serious.
The pressure was immense. We had no idea how far the Canadian government was willing to go. And judging by what they had done: very far.
Concerned about the risks to their families, two members of our team decided to quit.
It was an existential crisis.
To complicate the situation, my own personal life was in upheaval.
Around the time the Emergencies Act was invoked, I learned that I would soon become a father.
I went from pure joy to total distress within a week. I thought about the world my child was going to grow up in.
I thought about why I started a Bitcoin company in the first place.
If Bitcoin couldn’t matter in a situation where people needed it most, what good is it? How is it any different from the corrupt, permissioned financial system we grew up with? The one that brought the world to its knees in the Great Financial Crisis, along with many other social woes that we’ve only begun to understand since the shift in 1971? What’s the point of it all?
What will I tell my son about what happened in February 2022?
Then I sat down and wrote the reply.
That email became our North Star. It clarified our mission: to build tools that maximize individual financial freedom and privacy, minimizing reliance on any third party.
"Trusted third parties are security holes", as the great Nick Szabo once said.
This event taught us that true sovereignty requires technologies designed to withstand pressure. Not just from governments, but from time itself.
If we are to secure wealth for generations, our solutions must eliminate ALL single points of failure. They must be designed to outlive us.
Today we announce the next major step in that mission: the realization of our commitment to trust-minimized generational security.
Today we introduce the first assisted Bitcoin inheritance solution, designed to outlive the company that created it. It’s the culmination of all the work we’ve done since that fateful day in 2022. You can read about it here:
https://nunchuk.io/blog/autonomous-inheritance
🙏🏻
We just published: How to recover your Nunchuk Miniscript wallet with Bitcoin Core.
Happy Bitcoin Whitepaper Day! 📜
New mobile and desktop release:
Nunchuk now fully supports nostr:nprofile1qqsvetzrdtkpc8kz4eg54hstse8rx7cye5cvcgw9p4e7pt4s6nadw9gpzemhxue69uhhyetvv9ujuurjd9kkzmpwdejhgqgjwaehxw309ahx7um5wgh85cny9enkwr2z2sc wallet descriptors, including Miniscript wallets that reuse keys across policies.
Next week, we’ll publish a Recovery guide on how to independently recover a Nunchuk Miniscript wallet in Bitcoin Core.
nostr:nprofile1qqs09jtvjlmyrxjn37zv70a89csegcz7rpyqjmnw29cveedhv7vagqqpz3mhxue69uhkummnw3ezummcw3ezuer9wcq3yamnwvaz7tmwdaehgu3wwccxctnfdul28gvj doesn’t support Miniscript yet, AFAIK.
You can sign, just can’t broadcast. If you try to broadcast, the network would reject it. The timelocks are enforced by consensus rules.
Thank you nostr:nprofile1qqsra0r5jp73ly50yz00yy8gwt9vqvl270lcne59x2rdghv3udg7l8spz3mhxue69uhkummnw3ezummcw3ezuer9wcq36amnwvaz7tmwdaehgu3dwp6kytnhv4kxcmmjv3jhytnwv46qdvhmt7 ! 🫡
Right, Miniscript currently doesn’t support sortedmulti descriptor.
Introducing Zen Hodl. 🧘♂️
A new Miniscript template to automatically lock your bitcoin for a set period. Self-enforced discipline that protects generational wealth.
Why use it?
💎 True HODLing: Protect your stack from
emotional, short-term decisions.
🧾 Tax Planning: Create an immutable record of your holding period for capital gains.
Find your zen. Available now in the latest Nunchuk app.
FYI, Nunchuk is unaffected. Nunchuk does not use Javascript or NPM.
https://primal.net/e/nevent1qqs04ag02shk3fw998vlrmp763psj6tne2umq6vctzlwd52vc4wvg6gu3wy3s
https://www.youtube.com/watch?v=R0M2TL7RARw
nostr:nprofile1qyvhwue69uhkyat8d4skutndva6hjtnwv46r5dpcxsuqz9nhwden5te0vfjhgcfwdehhxarjd9kzucmpd5qzqxvfqd89dw8kqmrjfaz6zt8gfggcg93p4tm3s2slv4jrszuugfmt74rjkj
🚨 Summary
A major security incident is unfolding involving npm (Node Package Manager), widely used in Bitcoin and cryptocurrency wallet software. A developer’s npm account was compromised, allowing malicious code to spread through the ecosystem.
🔑 What Happened
- A supply chain attack injected malicious code into npm packages used by many wallets.
- The code can silently replace crypto addresses during transactions with attacker-controlled ones.
- It doesn’t just substitute a random address—it chooses one visually similar to the intended recipient, making detection harder.
- Risk applies across multiple cryptocurrencies, not just Bitcoin.
🛠️ Impacted Wallets & Apps
Hardware wallets with npm-dependent companion apps:
Trezor (all models)
Ledger (Nano S, X, Stax)
BitBox02
Blockstream Jade
Keystone
BitKey
Hot/software wallets using npm:
Nunchuk
Blockstream Green
BlueWallet
Muun Wallet
Phoenix (only for on-chain, not Lightning)
Zeus (on-chain)
Exodus
Tangem app
🧭 Recommended Actions
1) Do not panic. If not actively transacting, funds are likely safe.
2) Verify all addresses carefully (not just first/last characters—check the full string).
3) Use hardware devices with a screen to confirm addresses before signing.
4) Avoid using compromised companion apps. Switch to Sparrow, Specter, Electrum, or Wasabi where possible.
5) Avoid BitKey and Tangem for now since they lack screens and require their own npm-dependent apps.
6) Hold off on non-urgent on-chain transactions until more clarity/patches emerge.
7) Lightning payments (invoices) appear unaffected.
FYI, Nunchuk is unaffected. We don’t use Javascript or NPM.
https://primal.net/e/nevent1qqs04ag02shk3fw998vlrmp763psj6tne2umq6vctzlwd52vc4wvg6gu3wy3s
Nunchuk unaffected. We don’t use Javascript.
https://primal.net/e/nevent1qqs04ag02shk3fw998vlrmp763psj6tne2umq6vctzlwd52vc4wvg6gu3wy3s
Nunchuk apps are NOT vulnerable to the recent NPM security exploit.
Our apps are fully native, with no Javascript or NPM dependencies. This was a conscious decision to reduce our supply chain to the bare minimum.
We believe that for mission-critical software like a Bitcoin wallet, avoiding Javascript and the web-based ecosystems is a fundamental security principle.
We agree. Taproot is very powerful ❤️
Thanks Jimmy for the mention! Just so you know, the Android release with Miniscript support is out now!
PSA: Do not install Nunchuk 1.71.1 on Android, because of a bug.
Source: https://x.com/nunchuk_io/status/1961903257225515067
#bitcoin #nunchuk #selfcustody
Thanks for sharing. The issue is fixed now in v1.71.2.
Sure, you just need to export/import the wallet descriptors or BSMS file into Nunchuk (Nunchuk is built on open BIP standards).
Nunchuk does support watch-only. You only need to pair a hardware signer with the app to make it watch-only.
That's a valid point. Finding the right balance in our messaging is a constant challenge, and we take the responsibility to avoid creating that anxiety very seriously.
But for us, putting up a paywall isn't the answer, because 1Password, as great as they are, don’t solve the same existential threat we're focused on.
Bitcoin self-custody is already seen as "hard" by most people, and the massive push towards ETFs and custodial services makes it worse every day. Our core mission is to fight that trend. From day one.
What use are our services if the foundation itself gets destroyed? If 90% of Bitcoin ends up with custodians in 20 years, the project will have failed, and everything we've been building (which, btw, include networks like Nostr) will have been for nothing.
To win this battle, the best and most secure tools for self-custody must be free and accessible to the largest number of people possible. That's why the Nunchuk base app will always be free. It’s non-negotiable for us.
It’s on the roadmap, yes. We also have a major release coming soon. One of our best features to date. Stay tuned!
No worries at all, and thanks for the clarification. Finding the right way to present our paid services without being intrusive is a tough balance. It’s something we always try to improve on. Appreciate the feedback.
The idea of a paid base app is interesting, but we're committed to keeping the core tools free for all, for reason we highlighted above: we need as many people as possible to have access to safe and easy to use self-custody tools. If the base app is paid, we wouldn’t be able to achieve that goal.
Respectfully, the claim that we 'only exist to get users to join premium bullshit services' is the opposite of reality.
Since day one, we have been pouring huge resources into building and maintaining a professional-grade Bitcoin wallet and offer it for free. We led the way with standards like BIP129, advanced coin control and were first with features like encrypted group wallet and Taproot/MuSig2 support. We do this because we believe that if the majority of Bitcoin is not in self-custody, the project will fail. In fact, the vast majority of our users are free users, and we dedicate about 80% of our development efforts each year to free features.
Calling our premium services 'bullshit' is a mischaracterization. They solve critical, high-stakes problems for people who need them, and the revenue from those services is precisely what allows us to keep the core wallet free, private, and independent.
The alternative is VC funding, ads, or tracking users. We're committed to building a sustainable business on a Bitcoin standard, and we believe our model is the right one for our users and for Bitcoin itself.